mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
82 lines
3.3 KiB
YAML
82 lines
3.3 KiB
YAML
name: Azure Runbook Webhook Created
|
|
id: e98944a9-92e4-443c-81b8-a322e33ce75a
|
|
version: 3
|
|
date: '2023-12-20'
|
|
author: Mauricio Velazco, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic identifies the creation of a new Automation Runbook
|
|
Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform
|
|
that allows administrators to automate Azure management tasks and orchestrate actions
|
|
across external systems within Azure. Azure Automation script files called Runbooks
|
|
that can be written in PowerShell or Python. One of the ways administrators can
|
|
configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom
|
|
unauthenticated URLs that are exposed to the Internet. An adversary who has obtained
|
|
privileged access to an Azure tenant may create a Webhook to trigger the execution
|
|
of an Automation Runbook with malicious code that can create users or execute code
|
|
on a VM. This provides a persistent foothold on the environment.
|
|
data_source: []
|
|
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded
|
|
| dedup object
|
|
| rename claims.ipaddr as src_ip
|
|
| rename caller as user
|
|
| stats count min(_time) as firstTime max(_time) as lastTime values(object) as object by user, src_ip, resourceGroupName, object_path
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `azure_runbook_webhook_created_filter`'
|
|
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
|
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
|
You must be ingesting Azure Audit events into your Splunk environment. Specifically,
|
|
this analytic leverages the Azure Activity log category.
|
|
known_false_positives: Administrators may legitimately create Azure Runbook Webhooks.
|
|
Filter as needed.
|
|
references:
|
|
- https://docs.microsoft.com/en-us/azure/automation/overview
|
|
- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
|
|
- https://docs.microsoft.com/en-us/azure/automation/automation-webhooks?tabs=portal
|
|
- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
|
|
- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
|
|
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
|
|
- https://attack.mitre.org/techniques/T1078/004/
|
|
tags:
|
|
analytic_story:
|
|
- Azure Active Directory Persistence
|
|
asset_type: Azure
|
|
confidence: 90
|
|
impact: 70
|
|
message: A new Azure Runbook Webhook $object$ was created by $caller$
|
|
mitre_attack_id:
|
|
- T1078
|
|
- T1078.004
|
|
observable:
|
|
- name: object
|
|
type: Other
|
|
role:
|
|
- Victim
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Attacker
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- operationName.localizedValue
|
|
- status.value
|
|
- object
|
|
- caller
|
|
- claims.ipaddr
|
|
- resourceGroupName
|
|
- object_path
|
|
risk_score: 63
|
|
security_domain: threat
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log
|
|
source: mscs:azure:audit
|
|
sourcetype: mscs:azure:audit
|
|
update_timestamp: true
|